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About BSAC 


The British Screen Advisory Council (BSAC) is an independent, industry-funded 
body which works to advance the prosperity and enhance the prestige, 
effectiveness and reputation of the audiovisual and interactive industries of the 
United Kingdom. As a membership organisation comprising senior executives 
from the broadest possible range of interests in the screen sectors, it provides an 
informed lead on emerging business trends and advice on policy. 


Members! are senior figures drawn from a wide range of businesses and 
organisations operating in the film, TV, video game, online and/or mobile 
sectors. We aim to cover the whole value chain as well as the full range of means 
of distribution, so include members who can speak for writers, technicians, 
independent producers, directors, studio operators, distributors, exhibitors, 
broadcasters, games publishers, games developers, pay TV platforms and online 
platforms. It’s a unique cross-sectoral mix, with a balance of creative, policy and 
business specialists. 


Introduction 


1 


3. This BSAC paper is submitted to the Information Commissioner’s Office (ICO) in 


response to ICO consultation on the proposed Age Appropriate Design Code (“the 
Code”). 


. BSAC has taken a long-standing interest in regulatory developments affecting 


screen sector businesses and fully supports the aim of ensuring that online 
services appropriately safeguard children’s personal data. However, this is a 
complex area and we are concerned that the Code goes well beyond safeguarding 
children’s personal data and that the process is being rushed. In particular, we 
consider that there are significant risks of unintended negative consequences, 
both for screen sector businesses and for the children that use their online 
services, which have not been fully considered. The Code states that it covers all 
services ‘likely to be accessed by children’. This could prove difficult for screen 
sector ISS, including those who provide services aimed at a general audience, such 
as BBC iPlayer. We ask that that the code should therefore strike an appropriate 
balance taking into account the varying purposes of different types of service 
provider. 


For a full list of BSAC Members see our website, at https://www.bsac.uk.com/membership/ 
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The consultation timetable 


5. Weappreciate that the protection of children is an urgent need, but query whether 
it is sensible for the process in relation to the Code to run on sucha short timetable 
and in a manner which, in particular, does not properly allow for consideration of 
the potential interplay between the Code and the outcome of the current 
consultation on the Online Harms White Paper. The latter includes proposals for 
a statutory duty of care to be placed on providers of online services, overseen by 
an independent regulator (which may be either an existing regulatory body or a 
new one). 


6. The Online Harms White Paper consultation acknowledges that: 


“this is a complex and novel area for public policy. To this end, as well as 
setting out the government’s proposed approach, this White Paper poses a series 
of questions about the design of the new regulatory framework and non- 
legislative package”? 


7. Those questions invite submissions on a wide range of issues which may be 
relevant also to the Code, including key issues of effectiveness and proportionality 
(Question 5) and the nature of any advice or support that the regulator could 
provide to businesses, particularly start-ups and SMEs, to help comply with the 
regulatory framework (Question 9). Given that the deadline for submissions to 
the Online Harms White Paper consultation is not until 1 July, with the Home 
Office and DCMS then expected to take time to consider the views and evidence 
provided before finalising the government position, the timetable set out for the 
consultation on the Code and for it to come into force would not allow for a full 
and proper assessment of the combined impact of the two interventions. The risk 
is that, in addition to the potential unintended consequences identified below, the 
interplay between the Code and any final legislation that develops from the Online 
Harms White Paper may have further consequences that cannot be properly 
identified at this stage in the Online Harms process. 


8. Even without the complication of the Online Harms White Paper, a six week 
timetable for consultation is unnecessarily and disproportionately short given the 
substantial changes potentially required by the Code. The government 
consultation principles3, which give clear guidance to government departments 
on conducting consultations, advise as follows: 


2 See DCMS and Home Office, ‘Online Harms White Paper — Executive Summary (April 2019), 
paragraph a at https: Hw. BON. ul /government/consuitations/omine- o white- 
li 


Q. 
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“Judge the length of the consultation on the basis of legal advice and taking 
into account the nature and impact of the proposal. Consulting for too long 
will unnecessarily delay policy development. Consulting too quickly will not 
give enough time for consideration and will reduce the quality of responses.” 


We note that Ofcom, for example, would normally provide a 12 week consultation 
period, including for potential changes which are arguably less significant than 
the proposed adoption of the Code. 


Unintended consequences 


10. As noted above, we consider that there are significant risks of unintended 


11. 


12. 


13. 


consequences, both for screen sector businesses and for the children that use their 
online services, which have not been fully considered. Among these are the 
negative effects on innovation and, especially, on SMEs. 


It is well established that new regulatory requirements tend to have a 
disproportionately large effect on SMEs. For example, in its report on “Regulatory 
barriers and firm innovation performance”™4, one of the key findings of the 
EC Business Innovation Observatory is that: 


“SMEs are more affected than large companies by regulatory costs as the latter 
can often take advantage of economies of scale and scope associated with the 
administration of regulatory obligations and the investment required for 
compliance with these obligations.” [page 7] 


This issue was raised in the ICO call for evidence, and the ICO acknowledged in 
its response that: 


“Some of these challenges, such as ...... [ ].... cost implication remain and may 
be the subject of future work.” [page 16] 


BSAC considers that the cost implications, especially for SMEs, should be fully 
considered before the Code is finalised. Otherwise, there is a significant risk that 
the Code will stifle innovation, especially among SMEs, and entrench the position 
of scale players. 


See European Commission: Directorate-General for Internal Market, Industry, Entrepreneurship 
and SMEs, ‘Regulatory Barriers and Firm Innovation Performance’ (June 2018), at 
https: 


O1aa75ed71a1 
See ICO, ‘ICO’s call for evidence — Age appropriate design code: summary of responses’ 


(April 2019), at https://ico.org.uk/media/about-the-ico/consultations/2614764/20190108-aadc- 
summary-of-responses-with-ico-comment.pdf 
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14. That is not to suggest that the Code would not adversely affect established 
services. The Code in its current form is also likely to have a significant impact on 
such services, including popular free-to-access video-on-demand (VOD) services 
such as ITV Hub and All4. Services such as these rely on viewers to self-select 
their age and thus would not meet the criteria established in the Code of having a 
robust age verification system. 


15. Even when they target users aged 16 and over, the Code would require such 
services to adopt by default high privacy settings, significantly hindering their 
ability to carry out targeted advertising to adults. This would in turn have a 
significant impact on their ability to generate digital advertising revenue and 
therefore on their ability to fund original content. For Public Service 
Broadcasters, this would be likely to adversely affect investment in UK public 
service content including children’s programmes. 


16. In addition, the potential impact of the Code on different types of providers of 
Information Society Services (ISS), whether within or between sectors, needs 
further consideration without which the markets within which such ISS operate 
may be distorted in ways which are detrimental to users. For example, the costs 
associated with implementation may reduce children’s ability to access age 
appropriate ISS at least two ways: 


e such services being provided at increased cost to the child user as the 
increased costs of regulation are passed on; and 


e such services becoming commercially unviable and being withdrawn. 


Some such impacts will be hidden, specifically potential new services which are 
not developed in future as a result of the increased costs of provision. 


17. BSAC also notes the danger that the code may result in an increase in the 
collection and processing of personal data from children. There is an inherent 
tension between the practical requirement for such data in order to comply with 
certain aspects of the Code and the principle of data minimization enshrined 
elsewhere in the Code. Given the risks of data breaches associated with any such 
collection and processing, this may also require further consideration if 
inadvertent negative consequences are to be avoided. This point is particularly 
relevant to our comments on age verification systems, below. 


Age verification systems 


18. The Code places significant emphasis on the use of robust age verification systems 
as a means of ensuring age appropriate application. In particular, Standard 2 
requires that all 16 standards are applied to all users by default unless such age- 
verification processes are in place. 
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19. BSAC notes that under separate legislation, the UK is about to bring into force age 
verification requirements for online pornography. Under section 14(1) of the 
Digital Economy Act 2017, all providers of online commercial pornographic 
services accessible from the UK will be required to carry age-verification controls 
to ensure that their content is not normally accessible to children. This 
requirement will come into force on 15 July 2019 and is expected to affect many 
millions of UK users of online commercial pornographic services. 


20.Given the concerns that have been expressed about the reach, efficacy and cost of 
such systems, and about the additional data protection risks associated with any 
additional collection and processing of personal data, BSAC considers that it 
would be sensible for the ICO to allow time for an assessment of how the Digital 
Economy Act 2017 provisions have worked in practice before putting in place a 
statutory requirement for all ISS to either default to a child-appropriate setting or 
put in place robust age verification systems. 


21. Additionally, the ICO should consider the type of age-verification that should be 
undertaken. Requiring users to submit passports, driving licenses or ID cards 
would be disproportionate in a great many cases and gives rise to a number of 
other issues, including amplifying the scope of data collected by the service 
provider. 


Proportionality 


22. BSAC notes that the Code appears to significantly overreach the requirements set 
out in the GDPR and we are concerned that the blanket approach taken by the 
Code will result in additional regulatory costs which are disproportionate to the 
sorts of harms that children might face when using screen sector services which 
are already providing a trusted space for young people and which already collect 
and process data in line with GDPR. 


23. BSAC notes that screen sector ISS already operate within a variety of regulatory 
frameworks, including GDPR and a range of sector-specific statutory, co- 
regulatory and self-regulatory regimes. 


24.An ISS which is also an on-demand audiovisual media service® is already 
regulated under the EU Audiovisual Media Services Directive (the AVMS 


6 Article 1 of the Audiovisual Media Services Directive defines an audiovisual media service as “a 
service as defined by Articles 56 and 57 of the Treaty on the Functioning of the European Union 
which is under the editorial responsibility of a media service provider and the principal purpose 
of which is the provision of programmes, in order to inform, entertain or educate, to the general 
public by electronic communications networks within the meaning of point (a) of Article 2 of 
Directive 2002/21/EC. Such an audiovisual media service is either a television broadcast as 
defined in point (e) of this paragraph or an on-demand audiovisual media service as defined in 
point (g) of this paragraph”. While television broadcast services are excluded from the scope of 
the Code, on-demand audiovisual media services are clearly intended to be included, if they are 
likely to be accessed by children. 
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Directive). In the UK, the provisions of the AVMS Directive are enforced by Ofcom 
which has put in place statutory rules for UK on-demand programme services 
(ODPS) which provide for even greater protection for children than are required 
by the Directive. 


In particular, the Ofcom Rules for ODPS7 require that such services: 


e must not contain any material likely to incite hatred based on race, sex, 
religion or nationality; 


e must not contain any prohibited material (i.e. material which has been or 
would be refused a classification certificate for sale offline); 


e must not contain any specially restricted material (i.e. material which 
would be restricted to sale in a licensed sex shop if supplied offline, or other 
material that might seriously impair the physical, mental or moral 
development of under 18s) unless the material is made available in a 
manner which secures that persons under the age of 18 will not normally 
see or hear it; and 


e comply with a range of restrictions on sponsorship and product 
placement, including: 


O 


O 


a ban on sponsorship or product placement by a tobacco company 
or for the purposes of promoting tobacco products, electronic 
cigarettes or prescription-only medicines; 

a ban on product placement in children’s programmes; 

a ban on sponsorship of news or current affairs programmes; 

a requirement that sponsorship must not influence the content of 
that service or programme in a way that affects the editorial 
independence of the provider of the service; 

a ban on direct encouragement to purchase goods or services that 
are the subject of the sponsorship; 

a ban on sponsorship or product placement relating to alcoholic 
drinks if the service, programme or sponsorship announcement 
is aimed specifically at persons under the age of eighteen or 
encourages the immoderate consumption of such drinks; and 

a requirement to clearly inform users of the existence of a 
sponsorship agreement. 


See Ofcom, ‘On Demand Programme Service Rules’ (April 2017), at 
https://www.ofcom.org.uk/tv-radio-and-on-demand/broadcast-codes/broadcast-code/on- 


demand-programme-service-rules 
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25. BSAC notes that the revised AVMS Directive, which must be implemented in all 
Member States by 19 September 2020, extends the reach of such rules to include 
on-demand programme services which provide access to short-form content® and 
also includes the following requirement?: 


“Personal data of minors collected or otherwise generated by media service 
providers pursuant to paragraph 1 [1.e. in order to ensure under 18s will not 
normally see or hear material which may impair their physical, mental or moral 
development of minors] shall not be processed for commercial purposes, such as 
direct marketing, profiling and behaviourally targeted advertising.” 


26.In addition, the revised AVMS Directive brings within its scope video sharing 
platforms, requiring them, among other things, to protect minors from 
programmes, user-generated videos and _ audiovisual commercial 
communications which may impair their physical, mental or moral development; 
and also requiring that personal data of minors collected or otherwise generated 
by video-sharing platform providers pursuant to operating age verification 
systems or parental control systems shall not be processed for commercial 
purposes, such as direct marketing, profiling and behaviourally targeted 
advertising!°. 


27. Many screen sector ISS are therefore already operating within a highly respected 
statutory regime which provides protections for both child and adult users 
without requiring the services to default to a child appropriate setting. Others 
operate within well-established voluntary regulatory regimes. For example, the 
video games sector operates within the PEGI system". All gaming consoles, 
handheld devices and operating systems for PC and Mac are equipped with 
parental control systems, allowing parents to protect their children's privacy and 
online safety according to various parameters. With these control tools, parents 
can: 


e select which games children are allowed to play (based on the PEGI age 
ratings); 

control and monitor the use of digital purchases; 

limit access to internet browsing by applying a filter; 

control the amount of time that children can spend playing games; and 
control the level of online interaction (chat) and exchange of data (text 
messages, user-generated content). 


Services providing access to short-form content had not previously been considered to meet the 
criteria defining an on-demand programme service as they were not sufficiently ‘tv-like’. The 
revised AVMS Directive broadens the definition of an ‘on-demand audiovisual media service’ and 
explicitly brings such services within its scope. Article 1; see: https://eur-lex.europa.eu/legal- 
content/EN/TXT/PDF/?uri=CELEX:32018L1808&from=EN 

Article 6a. 1, ibid 

Article 28b, ibid 

Ratings provided by PEGI have statutory force in the UK for games rated 16 and 18 which are 
supplied to the consumer on a physical storage medium, such as a disc; for other games — 
including online games — the scheme is self-regulatory. 
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28.In addition, many screen sector service providers — whether they fall within the 
definition of an ODPS or not - have put in place additional, voluntary, child- 
protection measures to ensure that the service is a trusted space. These include, 
for example, various types of content labelling and parental control systems which 
are widely used by ISS providing TV catch-up or video on demand services. 


29.As well as providing YouTube Kids, Google provides the free Family Link app 
which helps parents ‘stay in the loop’ and set and enforce ground rules that are 
appropriate for the particular child, including screen time, app downloading and 
in-app purchases with applicable devices. 


30.In adopting a blanket approach, which forces every ISS to default to a child 
appropriate setting for non-age verified users, the Code would not only impose 
disproportionate costs on such services (risking the negative inadvertent 
consequences noted above), it would also damage the frictionless experience 
users enjoy when accessing many screen sector ISS, for example the on-demand 
services provided by free to air broadcasters (including BBC iPlayer, ITV Hub and 
All4) or news and current affairs websites such as CNN and BBC News. It is not 
at all clear that users of these services, including parents, would regard the 
imposition of age-verification to be a proportionate response to the level of risk 
that might conceivably be faced by child users. 


31. Given the wide range of services that fall with the definition of an ISS (and the 
wide range of services that might be contained with a single ISS), the very 
different sectors within which they operate, the variety of measures already in 
place, and the potentially significant implications for both service providers and 
users, BSAC considers that a sector by sector impact assessment should have been 
conducted. Without such an impact assessment, there is a very real danger that 
the impact on many services, including in the screen sectors, will be 
disproportionate. 


Parental attitudes and engagement 


32. Finally, we are concerned that the ‘default on’ approach may send a message that 
a ‘magic bullet’ solution has now been deployed by the state, absolving parents 
from the need to engage pro-actively in the process of protecting children online. 


33. It has long been a fundamental tenet of online child protection that there must be 
an active partnership between government, industry, parents and children, with 
each playing their part. This approach has been founded in an understanding that 
there are no fool proof, all-encompassing measures than can be used to make sure 
that all children are safe at all times when online, just as there are no foolproof, 
all-encompassing measures than can be used to make sure that all children are 
safe at all times when offline. 
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34. BSAC notes that in her 2008 report, Safer Children in a Digital World!2, Dr Tanya 
Byron argued against default ‘child appropriate’ settings because they encourage 
a misplaced sense of safety and set up a binary safe/unsafe paradigm which 
hinders children’s ability to develop the skills they need to protect themselves in 
the online world, favouring instead parental control initiatives which encourage 
the active engagement of parents in making choices about the services and 
content which are appropriate for their particular child. We would therefore 
query whether a blanket ‘default on’ approach really is the best way of protecting 
children over the longer term. 


Conclusion 


35. BSAC considers that there should be significant further engagement with industry 
in order to ensure that any necessary further safeguards for children’s personal 
data can be put in place in a manner which is proportionate (taking into account 
existing mechanisms in sectors such as the screen sectors) and which minimizes 
the risks of unintended negative consequences, including in relation to any 
interplay with the Online Harms White Paper. We would be happy to engage with 
the ICO to help achieve this aim. 


For more information about BSAC 
Please see our website 
www.bsac.uk.com 


British Screen Advisory Council 
58 Broadwick Street, London, W1F 7AL 


Telephone: __ 
ina: 


12 See The Byron Review, ‘Safer Children in a Digital World’ (March 2008), at 
https: //webarchive.nationalarchives.gov.uk/20120107041050/https://www.education.gov.uk 


ublications/eOrderingDownload/DCSF-00334-2008.pdf 
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